@primitive.ai/prim 0.1.0-alpha.67 → 0.1.0-alpha.68

package/dist/daemon/server.js

@@ -966,9 +966,12 @@ function validDecisionUrl(value) {
     return void 0;
   }
 }
-function decisionLink(label, decisionUrl) {
+function decisionLink(label, decisionUrl, plain) {
   const url = validDecisionUrl(decisionUrl);
-  return url ? `\x1B]8;;${url}\x07\x1B[34;4m${label}\x1B[0m\x1B]8;;\x07` : label;
+  if (plain || !url) {
+    return label;
+  }
+  return `\x1B]8;;${url}\x07\x1B[34;4m${label}\x1B[0m\x1B]8;;\x07`;
 }
 function formatLabeled(labels, cap) {
   if (labels === void 0) {
@@ -985,13 +988,13 @@ function formatLabeled(labels, cap) {
 function formatTeammates(names, cap) {
   return formatLabeled(names?.map(stripControlChars), cap);
 }
-function formatTeammatesWithArea(teammates, cap) {
+function formatTeammatesWithArea(teammates, cap, plainLinks = false) {
   return formatLabeled(
     teammates?.map((t) => {
       const name = stripControlChars(t.name);
       const area = stripControlChars(t.area ?? "").trim();
       const label = area ? `${name} - ${area}` : name;
-      return decisionLink(label, t.decisionUrl);
+      return decisionLink(label, t.decisionUrl, plainLinks);
     }),
     cap
   );
@@ -999,25 +1002,26 @@ function formatTeammatesWithArea(teammates, cap) {
 
 // src/lib/statusline-render.ts
 var STATUSLINE_NAME_CAP = 3;
-function formatStatusline(version, snapshot, resolveIngestionStatus) {
+function formatStatusline(version, snapshot, resolveIngestionStatus, options = {}) {
+  const ingestionSuffix = (status) => status === void 0 ? "" : ` \xB7 Decision ingestion ${status}`;
+  const ingestionStatus = snapshot === null || snapshot.healthy === false ? options.includeIngestionWhenUnavailable ? resolveIngestionStatus() : void 0 : resolveIngestionStatus();
   if (!snapshot) {
-    return `primitive ${version} (daemon: down)`;
+    return `primitive ${version} (daemon: down${ingestionSuffix(ingestionStatus)})`;
   }
   if (snapshot.healthy === false) {
     if (snapshot.needsReauth) {
-      return `primitive ${version} (daemon: paused \xB7 run \`prim auth login\`)`;
+      return `primitive ${version} (daemon: paused \xB7 run \`prim auth login\`${ingestionSuffix(ingestionStatus)})`;
     }
     if (snapshot.ingestion?.healthy === false) {
       const pending = snapshot.ingestion.pendingCount;
       const qualifier = snapshot.ingestion.pendingSampled ? "at least " : "";
-      return `primitive ${version} (daemon: degraded \xB7 delivery: stalled${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""})`;
+      return `primitive ${version} (daemon: degraded \xB7 delivery: stalled${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""}${ingestionSuffix(ingestionStatus)})`;
     }
     if (snapshot.heartbeat?.healthy === false) {
-      return `primitive ${version} (daemon: degraded \xB7 presence: unavailable)`;
+      return `primitive ${version} (daemon: degraded \xB7 presence: unavailable${ingestionSuffix(ingestionStatus)})`;
     }
-    return `primitive ${version} (daemon: starting)`;
+    return `primitive ${version} (daemon: starting${ingestionSuffix(ingestionStatus)})`;
   }
-  const ingestionStatus = resolveIngestionStatus();
   if (snapshot.envMismatch) {
     return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 presence: other env)`;
   }
@@ -1026,7 +1030,7 @@ function formatStatusline(version, snapshot, resolveIngestionStatus) {
   }
   let team;
   if (snapshot.onlineTeammates !== void 0) {
-    team = `team: ${formatTeammatesWithArea(snapshot.onlineTeammates, STATUSLINE_NAME_CAP)}`;
+    team = `team: ${formatTeammatesWithArea(snapshot.onlineTeammates, STATUSLINE_NAME_CAP, options.plainLinks === true)}`;
   } else if (snapshot.onlineNames !== void 0) {
     team = `team: ${formatTeammates(snapshot.onlineNames, STATUSLINE_NAME_CAP)}`;
   } else if (typeof snapshot.onlineCount === "number") {
@@ -1147,6 +1151,56 @@ function daemonRequest(method, params = {}, opts = {}) {
   });
 }
 
+// src/daemon/decision-digest-cache.ts
+var DECISION_DIGEST_CACHE_WARMING = "daemon Decision cache warming";
+var DECISION_DIGEST_CACHE_LIMIT = 100;
+var DECISION_DIGEST_CACHE_WINDOW = "24h";
+var DECISION_DIGEST_CACHE_PATH = `/api/cli/decisions/recent?limit=${String(DECISION_DIGEST_CACHE_LIMIT)}&since=${DECISION_DIGEST_CACHE_WINDOW}`;
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var DecisionDigestCache = class {
+  constructor(load, now = Date.now) {
+    this.load = load;
+    this.now = now;
+  }
+  snapshot = {
+    decisions: [],
+    unavailable: DECISION_DIGEST_CACHE_WARMING
+  };
+  refreshInFlight;
+  read() {
+    return { ...this.snapshot, decisions: [...this.snapshot.decisions] };
+  }
+  refresh() {
+    if (this.refreshInFlight) return this.refreshInFlight;
+    this.refreshInFlight = this.performRefresh().finally(() => {
+      this.refreshInFlight = void 0;
+    });
+    return this.refreshInFlight;
+  }
+  async performRefresh() {
+    try {
+      const value = await this.load();
+      if (typeof value !== "object" || value === null || !Array.isArray(value.decisions)) {
+        throw new Error("malformed Decision feed response");
+      }
+      this.snapshot = {
+        decisions: value.decisions,
+        cachedAt: this.now(),
+        unavailable: typeof value.unavailable === "string" ? value.unavailable : void 0
+      };
+    } catch (error) {
+      if (this.snapshot.cachedAt === void 0) {
+        this.snapshot = {
+          decisions: [],
+          unavailable: `daemon Decision cache unavailable: ${errorMessage(error)}`
+        };
+      }
+    }
+  }
+};
+
 // src/daemon/env-binding.ts
 function normalizeApiUrl(url) {
   return url.trim().replace(/\/+$/, "");
@@ -1428,6 +1482,7 @@ var CONFIG_DIR = join9(homedir6(), ".config", "prim");
 var SOCK_PATH2 = join9(CONFIG_DIR, "sock");
 var HEARTBEAT_INTERVAL_MS = 3e4;
 var INGESTION_POLL_INTERVAL_MS = 15e3;
+var DECISION_DIGEST_POLL_INTERVAL_MS = 5e3;
 var TOKEN_CHECK_INTERVAL_MS = 6e4;
 var TOKEN_REFRESH_THRESHOLD_MS = 9e4;
 var HTTP_PROXY_TIMEOUT_MS = 1e4;
@@ -1439,6 +1494,11 @@ var client = getClient();
 var runtimeVersion = resolveRuntimeVersion();
 var daemonHealth = createDaemonHealthState(runtimeVersion, process.pid, startedAt);
 var statuslineIngestionCache = new StatuslineIngestionCache(decisionIngestionStatus);
+var decisionDigestCache = new DecisionDigestCache(
+  async () => await client.get(DECISION_DIGEST_CACHE_PATH, {
+    signal: AbortSignal.timeout(HTTP_PROXY_TIMEOUT_MS)
+  })
+);
 var activeSessionId = process.env.PRIM_DAEMON_SESSION_ID ?? `daemon-${process.pid}`;
 var lastHeartbeatAt;
 var lastOnlineCount;
@@ -1447,6 +1507,7 @@ var lastOnlineTeammates;
 var lastOkAtLocal;
 var heartbeatTimer;
 var ingestionTimer;
+var decisionDigestTimer;
 var tokenCheckTimer;
 var heartbeatInFlight;
 var heartbeatRerunRequested = false;
@@ -1466,7 +1527,7 @@ function resolveRuntimeVersion() {
     return "unknown";
   }
 }
-function errorMessage(err) {
+function errorMessage2(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function persistHealth() {
@@ -1475,7 +1536,7 @@ function persistHealth() {
   try {
     writeDaemonHealthState(daemonHealth);
   } catch (err) {
-    process.stderr.write(`[prim-daemon] health-state error: ${errorMessage(err)}
+    process.stderr.write(`[prim-daemon] health-state error: ${errorMessage2(err)}
 `);
   }
 }
@@ -1500,9 +1561,13 @@ function enterReauthHold() {
     clearTimeout(ingestionTimer);
     ingestionTimer = void 0;
   }
+  if (decisionDigestTimer) {
+    clearTimeout(decisionDigestTimer);
+    decisionDigestTimer = void 0;
+  }
   persistHealth();
   process.stderr.write(
-    "[prim-daemon] authentication ended \u2014 halting heartbeat + ingestion until `prim auth login` (captures continue to the journal)\n"
+    "[prim-daemon] authentication ended \u2014 halting heartbeat + ingestion + Decision cache until `prim auth login` (captures continue to the journal)\n"
   );
 }
 function exitReauthHold() {
@@ -1517,10 +1582,11 @@ function exitReauthHold() {
   daemonHealth.ingestion.lastError = void 0;
   persistHealth();
   process.stderr.write(
-    "[prim-daemon] re-authentication detected \u2014 resuming heartbeat + ingestion\n"
+    "[prim-daemon] re-authentication detected \u2014 resuming heartbeat + ingestion + Decision cache\n"
   );
   void sendHeartbeat();
   void runIngestionLoop();
+  void runDecisionDigestLoop();
 }
 async function takeOwnership() {
   const now = Date.now();
@@ -1570,7 +1636,7 @@ function cleanup() {
     try {
       releaseDaemonOwnership(ownership, SOCK_PATH2);
     } catch (err) {
-      process.stderr.write(`[prim-daemon] cleanup error: ${errorMessage(err)}
+      process.stderr.write(`[prim-daemon] cleanup error: ${errorMessage2(err)}
 `);
     }
   }
@@ -1603,14 +1669,14 @@ async function performHeartbeat() {
     }
     persistHealth();
   } catch (err) {
-    daemonHealth.heartbeat.lastError = errorMessage(err);
+    daemonHealth.heartbeat.lastError = errorMessage2(err);
     daemonHealth.heartbeat.consecutiveFailures += 1;
     persistHealth();
     if (isSessionEnded()) {
       enterReauthHold();
       return;
     }
-    process.stderr.write(`[prim-daemon] heartbeat error: ${errorMessage(err)}
+    process.stderr.write(`[prim-daemon] heartbeat error: ${errorMessage2(err)}
 `);
   }
 }
@@ -1681,7 +1747,7 @@ async function runIngestionLoop() {
     const failures = daemonHealth.ingestion.consecutiveFailures + 1;
     const delay = ingestionRetryDelayMs(failures);
     daemonHealth.ingestion.consecutiveFailures = failures;
-    daemonHealth.ingestion.lastError = `journal scan failed: ${errorMessage(err)}`;
+    daemonHealth.ingestion.lastError = `journal scan failed: ${errorMessage2(err)}`;
     daemonHealth.ingestion.nextRetryAt = Date.now() + delay;
     persistHealth();
     scheduleIngestion(delay);
@@ -1716,7 +1782,7 @@ async function runIngestionLoop() {
     const delay = ingestionRetryDelayMs(failures);
     daemonHealth.ingestion.lastAcknowledgedCount = err instanceof FlushError ? err.flushed : 0;
     daemonHealth.ingestion.consecutiveFailures = failures;
-    daemonHealth.ingestion.lastError = errorMessage(err);
+    daemonHealth.ingestion.lastError = errorMessage2(err);
     daemonHealth.ingestion.nextRetryAt = Date.now() + delay;
     try {
       updatePendingHealth();
@@ -1727,11 +1793,25 @@ async function runIngestionLoop() {
       enterReauthHold();
       return;
     }
-    process.stderr.write(`[prim-daemon] ingestion error: ${errorMessage(err)}
+    process.stderr.write(`[prim-daemon] ingestion error: ${errorMessage2(err)}
 `);
     scheduleIngestion(delay);
   }
 }
+function scheduleDecisionDigestRefresh() {
+  if (shuttingDown || reauthHold) return;
+  decisionDigestTimer = setTimeout(() => {
+    decisionDigestTimer = void 0;
+    void runDecisionDigestLoop();
+  }, DECISION_DIGEST_POLL_INTERVAL_MS);
+}
+function refreshDecisionDigest() {
+  return shuttingDown || reauthHold ? Promise.resolve() : decisionDigestCache.refresh();
+}
+async function runDecisionDigestLoop() {
+  await refreshDecisionDigest();
+  scheduleDecisionDigestRefresh();
+}
 function pathParam(params) {
   if (typeof params.path !== "string" || !params.path.startsWith("/api/cli/")) {
     throw new Error("proxy request requires `path: string` under /api/cli/");
@@ -1818,6 +1898,7 @@ async function dispatchRequest(req) {
           activeSessionId = sid;
         }
         await sendHeartbeat();
+        void refreshDecisionDigest();
         return { id, ok: true, result: { sessionId: activeSessionId } };
       }
       case "session_end": {
@@ -1825,6 +1906,12 @@ async function dispatchRequest(req) {
       }
       case "status_snapshot":
         return { id, ok: true, result: handleStatusSnapshot(req.params ?? {}) };
+      case "decision_digest_snapshot": {
+        assertCallerEnvMatches(req.params?.callerEnv, getSiteUrl());
+        const result = decisionDigestCache.read();
+        void refreshDecisionDigest();
+        return { id, ok: true, result };
+      }
       case "statusline_invalidate":
         statuslineIngestionCache.clear();
         return { id, ok: true, result: { ack: true } };
@@ -1959,6 +2046,7 @@ function startTimers() {
     persistHealth();
     void sendHeartbeat();
     void runIngestionLoop();
+    void runDecisionDigestLoop();
   }
   void runTokenCheckLoop();
 }
@@ -1987,6 +2075,9 @@ function stopTimers() {
   if (ingestionTimer) {
     clearTimeout(ingestionTimer);
   }
+  if (decisionDigestTimer) {
+    clearTimeout(decisionDigestTimer);
+  }
   if (tokenCheckTimer) {
     clearTimeout(tokenCheckTimer);
   }
@@ -2001,14 +2092,14 @@ function installSignalHandlers() {
     shutdown(EXIT_CRASH, `[prim-daemon] uncaught: ${err.message}`);
   });
   process.on("unhandledRejection", (err) => {
-    shutdown(EXIT_CRASH, `[prim-daemon] unhandled rejection: ${errorMessage(err)}`);
+    shutdown(EXIT_CRASH, `[prim-daemon] unhandled rejection: ${errorMessage2(err)}`);
   });
 }
 async function main() {
   try {
     await takeOwnership();
   } catch (err) {
-    process.stderr.write(`[prim-daemon] ${errorMessage(err)}
+    process.stderr.write(`[prim-daemon] ${errorMessage2(err)}
 `);
     cleanup();
     process.exit(EXIT_CRASH);

package/dist/hooks/post-tool-use.js

@@ -1,9 +1,7 @@
 #!/usr/bin/env node
 import {
-  bold,
-  color,
   requireDurableIngestAcknowledgement
-} from "../chunk-JQFN6LBO.js";
+} from "../chunk-XGADQPCI.js";
 import {
   enrichHookPayloadWithFileRefs,
   preserveHookFileMetadata
@@ -24,8 +22,14 @@ import {
   scrubFromCwd
 } from "../chunk-G5D3FF3D.js";
 import {
+  appendCodexContext,
+  prepareCodexContext
+} from "../chunk-I5BHJQH2.js";
+import {
+  bold,
+  color,
   warmBinCache
-} from "../chunk-CZ24W5QU.js";
+} from "../chunk-K3AYW6VZ.js";
 import {
   isRepoActiveForCapture,
   repoSyncId,
@@ -38,6 +42,7 @@ import {
   normalizeEnvelope,
   parseAgent
 } from "../chunk-TCDUH7AN.js";
+import "../chunk-UTKQTZHL.js";
 
 // src/hooks/post-tool-use.ts
 import { readFileSync } from "fs";
@@ -112,8 +117,19 @@ function readStdin() {
     });
   });
 }
-function emit() {
-  process.stdout.write("{}\n");
+async function emit(output = {}) {
+  return await new Promise((resolve) => {
+    try {
+      process.stdout.write(`${JSON.stringify(output)}
+`, (error) => resolve(!error));
+    } catch {
+      resolve(false);
+    }
+  });
+}
+async function emitWithAcknowledgment(output, acknowledge) {
+  const handedOff = await emit(output);
+  await acknowledge?.(handedOff);
 }
 function debug(msg) {
   if (process.env.PRIM_HOOK_VERBOSE === "1") {
@@ -128,31 +144,31 @@ async function main() {
   try {
     raw = await readStdin();
   } catch {
-    emit();
+    await emit();
     return;
   }
   let parsed;
   try {
     parsed = normalizeEnvelope(JSON.parse(raw), agent);
   } catch {
-    emit();
+    await emit();
     return;
   }
   let envelope = parsed;
   const isToolResult = envelope.hook_event_name === "PostToolUse" || agent === "claude_code" && envelope.hook_event_name === "PostToolUseFailure";
   const isHermesDenial = agent === "hermes" && envelope.hook_event_name === "post_approval_response" && toolOutcomeFor(parsed, agent) === "prevented";
   if (!isToolResult && !isHermesDenial) {
-    emit();
+    await emit();
     return;
   }
   const invocationId = postToolInvocationId(parsed, agent);
   if (isHermesDenial && !invocationId) {
-    emit();
+    await emit();
     return;
   }
   const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
   if (!isHermesDenial && !editingToolsFor(agent).has(toolName)) {
-    emit();
+    await emit();
     return;
   }
   if (isHermesDenial && (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) && typeof envelope.extra?.session_key === "string" && envelope.extra.session_key.length > 0) {
@@ -160,17 +176,17 @@ async function main() {
     envelope = parsed;
   }
   if (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) {
-    emit();
+    await emit();
     return;
   }
   const cwd = parsed.cwd ?? process.cwd();
   if (!isRepoActiveForCapture(cwd)) {
-    emit();
+    await emit();
     return;
   }
   const resolvedRepository = resolveRepositoryContext(cwd);
   if (!resolvedRepository) {
-    emit();
+    await emit();
     return;
   }
   const repository = { ...resolvedRepository, repoSyncId: repoSyncId(cwd) };
@@ -183,11 +199,11 @@ async function main() {
   const { resolution } = enrichment;
   if (!isHermesDenial) {
     if (resolution.shellMutation === "none") {
-      emit();
+      await emit();
       return;
     }
     if (resolution.shellMutation === void 0 && resolution.fileRefs.length === 0) {
-      emit();
+      await emit();
       return;
     }
   }
@@ -201,18 +217,32 @@ async function main() {
     payload: preserveHookFileMetadata(scrubbed, resolution)
   };
   const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd: move.env.cwd });
+  let verdictFooter = false;
   try {
     const result = await deliverPostToolMove(move, orgId);
     debug(`durably ingested ${move.moveId} (${toolName})`);
     if (isVerdictFooterContext(result.verdictFooter)) {
+      verdictFooter = true;
       process.stderr.write(`${renderVerdictFooter(result.verdictFooter)}
 `);
     }
   } catch (err) {
     debug(`ingest failed: ${err instanceof Error ? err.message : String(err)}`);
   }
-  emit();
+  if (agent === "codex" && verdictFooter) {
+    try {
+      const context = await prepareCodexContext({
+        cwd,
+        sessionId: envelope.session_id,
+        includeDigest: false
+      });
+      await emitWithAcknowledgment(appendCodexContext({}, context.context), context.acknowledge);
+      return;
+    } catch {
+    }
+  }
+  await emit();
 }
-main().catch(() => {
-  emit();
+main().catch(async () => {
+  await emit();
 });

package/dist/hooks/pre-tool-use.js

@@ -13,10 +13,15 @@ import {
   readHookMode,
   scrub
 } from "../chunk-G5D3FF3D.js";
+import {
+  appendCodexContext,
+  hasVisibleCodexMessage,
+  prepareCodexContext
+} from "../chunk-I5BHJQH2.js";
 import {
   packageVersion,
   warmBinCache
-} from "../chunk-CZ24W5QU.js";
+} from "../chunk-K3AYW6VZ.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
@@ -30,6 +35,7 @@ import {
   normalizeEnvelope,
   parseAgent
 } from "../chunk-TCDUH7AN.js";
+import "../chunk-UTKQTZHL.js";
 
 // src/hooks/preflight-v3.ts
 import { Buffer as Buffer2 } from "buffer";
@@ -147,9 +153,19 @@ async function readStdin() {
   });
 }
 var agent = parseAgent(process.argv);
-function emit(output) {
-  process.stdout.write(`${JSON.stringify(output)}
-`);
+async function emit(output) {
+  return await new Promise((resolve) => {
+    try {
+      process.stdout.write(`${JSON.stringify(output)}
+`, (error) => resolve(!error));
+    } catch {
+      resolve(false);
+    }
+  });
+}
+async function emitWithAcknowledgment(output, acknowledge) {
+  const handedOff = await emit(output);
+  await acknowledge?.(handedOff);
 }
 function failOpen() {
   if (agent === "hermes") return failOpenHermes();
@@ -159,16 +175,28 @@ function invocationId(envelope) {
   const value = agent === "hermes" ? envelope.extra?.tool_call_id : envelope.tool_use_id;
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function emitUnverified(message) {
+async function emitUnverified(message, envelope) {
   const result = unverifiedResult(message);
   if (agent === "hermes") {
     process.stderr.write(`[primitive] ${message}
 `);
-    emit(failOpenHermes());
+    await emit(failOpenHermes());
   } else {
-    emit(
-      agent === "codex" ? buildCodexOutput("allow", [result]) : buildHookOutput("allow", [result])
-    );
+    let output = agent === "codex" ? buildCodexOutput("allow", [result]) : buildHookOutput("allow", [result]);
+    if (agent === "codex" && typeof envelope?.session_id === "string" && envelope.session_id) {
+      try {
+        const context = await prepareCodexContext({
+          cwd: envelope.cwd ?? process.cwd(),
+          sessionId: envelope.session_id,
+          includeDigest: false
+        });
+        output = appendCodexContext(output, context.context);
+        await emitWithAcknowledgment(output, context.acknowledge);
+        return;
+      } catch {
+      }
+    }
+    await emit(output);
   }
 }
 async function main() {
@@ -177,7 +205,7 @@ async function main() {
   try {
     raw = await readStdin();
   } catch {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   let envelope;
@@ -187,17 +215,17 @@ async function main() {
       agent
     );
   } catch {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   if (envelope.hook_event_name !== "PreToolUse") {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   const env = process.env;
   const mode = readHookMode(env);
   if (mode === "off") {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
@@ -209,22 +237,25 @@ async function main() {
     cwd
   });
   if (targets.mutation === "none") {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   if (!isRepoActive(cwd)) {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   if (targets.paths.length === 0) {
-    emitUnverified("mutation targets could not be determined; enforcement not verified");
+    await emitUnverified(
+      "mutation targets could not be determined; enforcement not verified",
+      envelope
+    );
     return;
   }
   const binding = repoSyncId(cwd);
   const sessionId = envelope.session_id;
   const callId = invocationId(envelope);
   if (!binding || typeof sessionId !== "string" || !sessionId || !callId) {
-    emitUnverified("repository binding or tool invocation identity is unavailable");
+    await emitUnverified("repository binding or tool invocation identity is unavailable", envelope);
     return;
   }
   const request = {
@@ -243,12 +274,12 @@ async function main() {
   try {
     const response = await requestPreflight(request);
     if (!response) {
-      emitUnverified("enforcement service returned an incompatible response");
+      await emitUnverified("enforcement service returned an incompatible response", envelope);
       return;
     }
     result = resultForPreflight(response);
   } catch {
-    emitUnverified("enforcement service unavailable; change was not verified");
+    await emitUnverified("enforcement service unavailable; change was not verified", envelope);
     return;
   }
   const aggregate = demoteForMode(
@@ -259,10 +290,18 @@ async function main() {
     process.stderr.write(`[primitive] ${result.reason || result.unavailable}
 `);
   }
-  emit(
-    agent === "hermes" ? buildHermesOutput(aggregate, [result]) : agent === "codex" ? buildCodexOutput(aggregate, [result]) : buildHookOutput(aggregate, [result])
-  );
+  let output = agent === "hermes" ? buildHermesOutput(aggregate, [result]) : agent === "codex" ? buildCodexOutput(aggregate, [result]) : buildHookOutput(aggregate, [result]);
+  if (agent === "codex" && hasVisibleCodexMessage(output) && typeof sessionId === "string" && sessionId.length > 0) {
+    try {
+      const context = await prepareCodexContext({ cwd, sessionId, includeDigest: false });
+      output = appendCodexContext(output, context.context);
+      await emitWithAcknowledgment(output, context.acknowledge);
+      return;
+    } catch {
+    }
+  }
+  await emit(output);
 }
-main().catch(() => {
-  emit(failOpen());
+main().catch(async () => {
+  await emit(failOpen());
 });